Role-template-based batch management of tenant-specific roles and rights in a computing system

ABSTRACT

An example method of managing rights in a cloud computing system includes: creating a role template having a role template set of rights to resources in the cloud computing system; assigning a tenant set of rights to the resources to each of a plurality of tenants of the cloud computing system, respectively; and creating a role instance for each respective tenant based on the role template and assigning the role instance to each respective tenant, where the role instance is linked to the role template in the cloud computing system and where the role instance includes a role instance set of rights that includes an intersection of the role template set of rights and the tenant set of rights for the respective tenant.

BACKGROUND

Cloud architectures are used in cloud computing and cloud storagesystems for offering infrastructure-as-a-service (IaaS) cloud services.Examples of cloud architectures include the VMware vCloud Director®cloud architecture software, Amazon EC2™ web service, and OpenStack™open source cloud computing service. IaaS cloud service is a type ofcloud service that provides access to physical and/or virtual resourcesin a cloud environment. These services provide a tenant applicationprogramming interface (API) that supports operations for manipulatingIaaS constructs, such as virtual machines (VMs) and logical networks.

A hybrid cloud system aggregates the resource capabilities from bothprivate and public clouds. A private cloud can include one or morecustomer data centers (referred to herein as “on-premise data centers”).The public cloud can include a multi-tenant cloud architecture providingIaaS cloud services. In a hybrid cloud system, it is desirable tosupport VM migration between the data center and the public cloud.Presently, to implement VM migration, a customer must first create a VMfrom scratch within the public cloud and then transfer data from apowered-off source VM in the on-premise data center to the newly createdVM in the public cloud. This process has the disadvantage of significantdowntime for the VM being migrated.

SUMMARY

In an embodiment, a method of managing rights in a cloud computingsystem includes: creating a role template having a role template set ofrights to resources in the cloud computing system; assigning a tenantset of rights to the resources to each of a plurality of tenants of thecloud computing system; and creating a role instance for each respectivetenant based on the role template and assigning the role instance toeach respective tenant, where the role instance is linked to the roletemplate in the cloud computing system and where the role instanceincludes a role instance set of rights that includes an intersection ofthe role template set of rights and the tenant set of rights for therespective tenant.

Further embodiments include a non-transitory computer-readable storagemedium comprising instructions that cause a computer system to carry outthe above method, as well as a computer system configured to carry outthe above method.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a hybrid cloud computing system in whichone or more embodiments of the present disclosure may be utilized.

FIG. 2 is a block diagram depicting a relationship between a roletemplates and instances in a cloud computing system according to anembodiment.

FIG. 3 is a flow diagram depicting a method of managing roles and rightsin a cloud computing system according to an embodiment.

FIG. 4 is a flow diagram depicting a method of synchronizing rights in arole instance according to an embodiment.

FIG. 5 is a flow diagram depicting a method of synchronizing rights in arole instance according to another embodiment.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe figures. It is contemplated that elements disclosed in oneembodiment may be beneficially utilized on other embodiments withoutspecific recitation.

DETAILED DESCRIPTION

Role-template-based batch management of tenant-specific roles and rightsin a computing system is described. The system enables a provider tobuild a cloud where each tenant may have different rights and custom,tenant-specific roles which compose these rights in addition to a commonset of ‘predefined’ role instances whose rights are the intersection ofthe tenant's specific rights and the rights of its associated roletemplate. Hence, the set of rights for a given predefined role instance,and the users to whom these roles are assigned, may vary from tenant totenant based on the privileges (rights) of each tenant. This systemallows tenants' rights, role-template rights, and custom tenant roles tobe managed separately. A change to either a tenant's rights or a roletemplate's rights will automatically update the set of rights in theaffected role instances. At any point, a tenant administrator may‘unlink’ a predefined role instance from its template so that its rightsare managed by the tenant administrator, rather than a system/provideradministrator. Reciprocally, a tenant may also relink a predefined roleinstance back to its template to restore the original behavior.

FIG. 1 is a block diagram of a hybrid cloud computing system 100 inwhich one or more embodiments of the present disclosure may be utilized.Hybrid cloud computing system 100 includes a virtualized computingsystem implementing an on-premise data center 102 and a virtualizedcomputing system implementing a cloud computing system 150. Hybrid cloudcomputing system 100 is configured to provide a common platform formanaging and executing virtual workloads seamlessly between on-premisedata center 102 and cloud computing system 150. In one embodiment,on-premise data center 102 may be a data center controlled andadministrated by a particular enterprise or business organization, whilecloud computing system 150 may be operated by a cloud computing serviceprovider and exposed as a service available to account holders, such asthe particular enterprise in addition to other enterprises. As such,on-premise data center 102 may sometimes be referred to as a “private”cloud, and cloud computing system 150 may be referred to as a “public”cloud. While the example of FIG. 1 includes on-premise data center 102,in some embodiments, on-premise data center 102 can be omitted. Thus,embodiments described herein can be used in a private cloud, publiccloud, or hybrid cloud system.

As used herein, an internal cloud or “private” cloud is a cloud in whicha tenant and a cloud service provider are part of the same organization,while an external or “public” cloud is a cloud that is provided by anorganization that is separate from a tenant that accesses the externalcloud. For example, the tenant may be part of an enterprise, and theexternal cloud may be part of a cloud service provider that is separatefrom the enterprise of the tenant and that provides cloud services todifferent enterprises and/or individuals. In embodiments disclosedherein, a hybrid cloud is a cloud architecture in which a tenant isprovided with seamless access to both private cloud resources and publiccloud resources.

On-premise data center 102 includes one or more host computer systems(“hosts 104”). Hosts 104 may be constructed on a server grade hardwareplatform 106, such as an x86 architecture platform. As shown, hardwareplatform 106 of each host 104 may include conventional components of acomputing device, such as one or more processors (CPUs) 108, systemmemory 110, a network interface 112, storage system 114, and other I/Odevices such as, for example, a mouse and keyboard (not shown). CPU 108is configured to execute instructions, for example, executableinstructions that perform one or more operations described herein andmay be stored in memory 110 and in local storage. Memory 110 is a deviceallowing information, such as executable instructions, cryptographickeys, virtual disks, configurations, and other data, to be stored andretrieved. Memory 110 may include, for example, one or more randomaccess memory (RAM) modules. Network interface 112 enables host 104 tocommunicate with another device via a communication medium, such as anetwork 122 within on-premise data center 102. Network interface 112 maybe one or more network adapters, also referred to as a Network InterfaceCard (NIC). Storage system 114 represents local storage devices (e.g.,one or more hard disks, flash memory modules, solid state disks, andoptical disks) and/or a storage interface that enables host 104 tocommunicate with one or more network data storage systems. Examples of astorage interface are a host bus adapter (HBA) that couples host 104 toone or more storage arrays, such as a storage area network (SAN) or anetwork-attached storage (NAS), as well as other network data storagesystems.

Each host 104 is configured to provide a virtualization layer thatabstracts processor, memory, storage, and networking resources ofhardware platform 106 into multiple virtual machines 120 ₁ to 120 _(N)(collectively referred to as VMs 120) that run concurrently on the samehosts. VMs 120 run on top of a software interface layer, referred toherein as a hypervisor 116, that enables sharing of the hardwareresources of host 104 by VMs 120. One example of hypervisor 116 that maybe used in an embodiment described herein is a VMware ESXi™ hypervisorprovided as part of the VMware vSphere® solution made commerciallyavailable from VMware, Inc. of Palo Alto, Calif. Hypervisor 116 may runon top of the operating system of host 104 or directly on hardwarecomponents of host 104.

On-premise data center 102 includes a virtualization managementcomponent (depicted in FIG. 1 as virtualization manager 130) that maycommunicate to the plurality of hosts 104 via a network, sometimesreferred to as a management network 126. In one embodiment,virtualization manager 130 is a computer program that resides andexecutes in a central server, which may reside in on-premise data center102, or alternatively, running as a VM in one of hosts 104. One exampleof a virtualization manager is the vCenter Server™ product madeavailable from VMware, Inc. Virtualization manager 130 is configured tocarry out administrative tasks for computing system 102, includingmanaging hosts 104, managing VMs 120 running within each host 104,provisioning VMs, migrating VMs from one host to another host, and loadbalancing between hosts 104.

In one embodiment, virtualization manager 130 includes a hybrid cloudmanagement module (depicted as hybrid cloud manager 132) configured tomanage and integrate virtualized computing resources provided by cloudcomputing system 150 with virtualized computing resources of computingsystem 102 to form a unified “hybrid” computing platform. Hybrid cloudmanager 132 is configured to deploy VMs in cloud computing system 150,transfer VMs from virtualized computing system 102 to cloud computingsystem 150, and perform other “cross-cloud” administrative tasks, asdescribed in greater detail later. In one implementation, hybrid cloudmanager 132 is a module or plug-in complement to virtualization manager130, although other implementations may be used, such as a separatecomputer program executing in a central server or running in a VM in oneof hosts 104. One example of hybrid cloud manager 132 is the VMwarevCloud Connector® product made available from VMware, Inc.

In one embodiment, hybrid cloud manager 132 is configured to controlnetwork traffic into network 122 via a gateway component (depicted as agateway 124). Gateway 124 (e.g., executing as a virtual appliance) isconfigured to provide VMs 120 and other components in on-premise datacenter 102 with connectivity to an external network 140 (e.g.,Internet). Gateway 124 may manage external public IP addresses for VMs120 and route traffic incoming to and outgoing from on-premise datacenter 102 and provide networking services, such as firewalls, networkaddress translation (NAT), dynamic host configuration protocol (DHCP),load balancing, and virtual private network (VPN) connectivity over anetwork 140.

In one or more embodiments, cloud computing system 150 is configured todynamically provide an enterprise (or users of an enterprise) with oneor more virtual data centers 170 in which a user may provision VMs 120,deploy multi-tier applications on VMs 120, and/or execute workloads.Cloud computing system 150 includes an infrastructure platform 154 uponwhich a cloud computing environment 170 may be executed. In theparticular embodiment of FIG. 1, infrastructure platform 154 includeshardware resources 160 having computing resources (e.g., hosts 162 ₁ to162 _(N)), storage resources (e.g., one or more storage array systems,such as SAN 164), and networking resources, which are configured in amanner to provide a virtualization environment 156 that supports theexecution of a plurality of virtual machines 172 across hosts 162. It isrecognized that hardware resources 160 of cloud computing system 150 mayin fact be distributed across multiple data centers in differentlocations.

Each cloud computing environment 170 is associated with a particulartenant of cloud computing system 150, such as the enterprise providingvirtualized computing system 102. In one embodiment, cloud computingenvironment 170 may be configured as a dedicated cloud service for asingle tenant comprised of dedicated hardware resources 160 (i.e.,physically isolated from hardware resources used by other users of cloudcomputing system 150). In other embodiments, cloud computing environment170 may be configured as part of a multi-tenant cloud service withlogically isolated virtualized computing resources on a shared physicalinfrastructure. As shown in FIG. 1, cloud computing system 150 maysupport multiple cloud computing environments 170, available to multipleenterprises in single-tenant and multi-tenant configurations.

In one embodiment, virtualization environment 156 includes anorchestration component 158 (e.g., implemented as a process running in aVM) that provides infrastructure resources to cloud computingenvironment 170 responsive to provisioning requests. For example, if anenterprise required a specified number of virtual machines to deploy aweb applications or to modify (e.g., scale) a currently running webapplication to support peak demands, orchestration component 158 caninitiate and manage the instantiation of virtual machines (e.g., VMs172) on hosts 162 to support such requests. In one embodiment,orchestration component 158 instantiates virtual machines according to arequested template that defines one or more virtual machines havingspecified virtual computing resources (e.g., compute, networking,storage resources). Further, orchestration component 158 monitors theinfrastructure resource consumption levels and requirements of cloudcomputing environment 170 and provides additional infrastructureresources to cloud computing environment 170 as needed or desired. Inone example, similar to on-premise data center 102, virtualizationenvironment 156 may be implemented by running on hosts 162 VMwareESXi™-based hypervisor technologies provided by VMware, Inc. (althoughit should be recognized that any other virtualization technologies,including Xen® and Microsoft Hyper-V® virtualization technologies may beutilized consistent with the teachings herein).

In one embodiment, cloud computing system 150 may include a clouddirector 152 (e.g., run in one or more virtual machines) that managesallocation of virtual computing resources to an enterprise for deployingapplications. Cloud director 152 may be accessible to users via a REST(Representational State Transfer) API (Application ProgrammingInterface) or any other client-server communication protocol. Clouddirector 152 may authenticate connection attempts from the enterpriseusing credentials issued by the cloud computing provider. Cloud director152 maintains and publishes a catalog 166 of available virtual machinetemplates, packaged virtual machine applications, virtual data centers,and the like that may be provisioned in cloud computing environment 170.A virtual machine template is a virtual machine image that is loadedwith a pre-installed guest operating system, applications, and data, andis typically used to repeatedly create a VM having the pre-definedconfiguration. A packaged virtual machine application is a logicalcontainer of pre-configured virtual machines having software componentsand parameters that define operational details of the packagedapplication. An example of a packaged VM application is vApp technologymade available by VMware, Inc., although other technologies may beutilized. A virtual data center includes one or more virtual machinesthat provides a pool of resources. Cloud director 152 receivesprovisioning requests submitted (e.g., via REST API calls) and maypropagates such requests to orchestration component 158 to instantiatethe requested virtual machines (e.g., VMs 172). One example of clouddirector 152 is the VMware vCloud Director® produced by VMware, Inc.

In the embodiment of FIG. 1, cloud computing environment 170 supportsthe creation of a virtual data center 180 having a plurality of virtualmachines 172 instantiated to, for example, host deployed multi-tierapplications, as well as one or more virtualization managers 173(abbreviated as “Vman(s)”). A virtual data center 180 is a logicalconstruct that provides compute, network, and storage resources to anorganization. Virtual data centers 180 provide an environment where VM172 can be created, stored, and operated, enabling complete abstractionbetween the consumption of infrastructure service and underlyingresources. VMs 172 may be configured similarly to VMs 120, asabstractions of processor, memory, storage, and networking resources ofhardware resources 160. Virtualization managers 173 can be configuredsimilarly to virtualization manager 130.

Virtual data center 180 includes one or more virtual networks 182 usedto communicate between VMs 172 and managed by at least one networkinggateway component (e.g., gateway 184), as well as one or more isolatedinternal networks 186 not connected to gateway 184. Gateway 184 (e.g.,executing as a virtual appliance) is configured to provide VMs 172 andother components in cloud computing environment 170 with connectivity toexternal network 140 (e.g., Internet). Gateway 184 manages externalpublic IP addresses for virtual data center 180 and one or more privateinternal networks interconnecting VMs 172. Gateway 184 is configured toroute traffic incoming to and outgoing from virtual data center 180 andprovide networking services, such as firewalls, network addresstranslation (NAT), dynamic host configuration protocol (DHCP), and loadbalancing. Gateway 184 may be configured to provide virtual privatenetwork (VPN) connectivity over a network 140 with another VPN endpoint,such as a gateway 124 within on-premise data center 102. In otherembodiments, gateway 184 may be configured to connect to communicatewith on-premise data center 102 using a high-throughput, dedicated link(depicted as a direct connect 142) between on-premise data center 102and cloud computing system 150. In one or more embodiments, gateways 124and 184 are configured to provide a “stretched” layer-2 (L2) networkthat spans on-premise data center 102 and virtual data center 180, asshown in FIG. 1.

While FIG. 1 depicts a single connection between on-premise gateway 124and cloud-side gateway 184 for illustration purposes, it should berecognized that multiple connections between multiple on-premisegateways 124 and cloud-side gateways 184 may be used. Furthermore, whileFIG. 1 depicts a single instance of a gateway 184, it is recognized thatgateway 184 may represent multiple gateway components within cloudcomputing system 150. In some embodiments, a separate gateway 184 may bedeployed for each virtual data center, or alternatively, for eachtenant. In some embodiments, a gateway instance may be deployed thatmanages traffic with a specific tenant, while a separate gatewayinstance manages public-facing traffic to the Internet. In yet otherembodiments, one or more gateway instances that are shared among all thetenants of cloud computing system 150 may be used to manage allpublic-facing traffic incoming and outgoing from cloud computing system150.

In one embodiment, each virtual data center 180 includes a “hybridity”director module (depicted as hybridity director 174) configured tocommunicate with the corresponding hybrid cloud manager 132 inon-premise data center 102 to enable a common virtualized computingplatform between on-premise data center 102 and cloud computing system150. Hybridity director 174 (e.g., executing as a virtual appliance) maycommunicate with hybrid cloud manager 132 using Internet-based trafficvia a VPN tunnel established between gateways 124 and 184, oralternatively, using direct connection 142. In one embodiment, hybriditydirector 174 may control gateway 184 to control network traffic intovirtual data center 180. In some embodiments, hybridity director 174 maycontrol VMs 172 and hosts 162 of cloud computing system 150 viainfrastructure platform 154.

In a multi-tenant system managed by a service provider, a user'ssecurity context governs what the user is entitled to do within thesystem. The cloud computing system derives a user's security contextfrom rights associated with role(s) assigned to the user. FIG. 2 is ablock diagram depicting a relationship between a role templates andinstances in a cloud computing system according to an embodiment. FIG. 3is a flow diagram depicting a method 300 of managing roles and rights ina cloud computing system according to an embodiment. Method 300 can beperformed for multiple tenants concurrently or in sequence.

Method 300 begins at step 302, where a system administrator of a serviceprovider 212 (e.g., a system administrator of cloud computing system150) creates a role template 202 having a default set of rights (defaultrights 204 or “role template” set of rights). While a single roletemplate 202 is described as an example, it is to be understood that aservice provider can create multiple role templates. A right isauthorization to create, modify, or access a resource in cloud computingsystem 150, such as a device (virtual or physical), software component,function of a software component, or the like. If a user is granted aright, the user can access the resource. Otherwise, the cloud computingsystem prevents the user from accessing the resource. The systemadministrator can create role template 202 using a component in cloudcomputing system 150, such as a tenant manager 153. Tenant manager 153can be a physical or virtual computing system similar to other computingsystems shown in FIG. 1 and described above. The system administratorcan create a plurality of role templates 202 for use by various tenantsin cloud computing system 150. Each role template 202 includes defaultrights (rights 204), which can differ from one role template to thenext.

At step 303, the system administrator of service provider 212 assignsrights 205 to tenant 210. Rights 205 are the set of rights that tenant210 from which tenant can select to be assigned to its users (alsoreferred to as a tenant set of rights).

At step 304, the system administrator of service provider 212, or atenant administrator of tenant 210, creates a role instance 206 based ona role template 202. Cloud computing system 150 maintains a link betweenrole instance 206 and role template 202 (step 306). The administratorcan create a plurality of role instances 206, each based on acorresponding role template 202. In an example, when a systemadministrator of service provider 212 creates a tenant, cloud computingsystem 150 creates default role instances for the tenant. A roleinstance 208 includes rights 208 (also referred to as a role instanceset of rights). Rights 208 are the intersection of default rights 204and rights 205. Initially, when role instance 206 is created, rights 208include all or a portion of default rights 204. Notably, any rights indefault rights 204 that are not part of rights 205 (those rights grantedto tenant 210), are not part of rights 208 in role instance 206 (sincetenant 210 as a whole would not have such rights). If all of defaultrights 204 are in rights 205 granted to tenant 210, then rights 208 inrole instance 206 would include all of default rights 204. When thesystem administrator updates role template 202 by adding or removingdefault rights 204, the changes are propagated to all role instances 206across tenants that are linked to role template 202.

At step 308, a tenant administrator of tenant 210 can add custom rightsto role instance 206 if desired. Custom rights are any of rights 205granted to tenant 210 that are not in the default rights 204. Thus, insome cases, rights 208 in role instance 206 can include more thandefault rights 204 (e.g., additional rights 205 granted to tenant 210that are not part of default rights 204). A tenant administrator cannotgrant a right 208 in role instance 206 that has not been granted totenant 210.

When rights are removed from tenant 210 (e.g., some of rights 205 areremoved), those removed rights are also removed from any role instances206 that contain them. When rights are added to tenant 210 (e.g., somerights are added to rights 205), those rights are automatically added toany role instance 206 linked to role templates 202 that contain thoserights (as part of default rights 204). Cloud computing system 150maintains this synchronization of rights over time as rights 205, aswell as default rights 204, are adjusted.

In addition to roles based on templates, the system can supporttenant-specific custom roles, i.e., roles that are not linked to a roletemplate, but have a set of rights selected from the rights granted tothe tenant by the service provider. Thus, in some embodiments, atoptional step 310, a tenant administrator of tenant 210 creates atenant-specific custom role and one or more instances thereof. Ingeneral, the tenant administrator can create one or more tenant-specificcustom roles. The tenant-specific custom role can include one or morerights that have been assigned to the tenant at step 203.

In some embodiments, at optional step 312, a tenant administrator oftenant 210 can unlink the role instance from the role template to createa tenant-specific role instance. The tenant administrator can then addor subtract rights from the tenant-specific role instance as desired. Asdiscussed further below, the tenant administrator can subsequentlyre-link the tenant-specific role instance to the role template, at whichtime its rights are synchronized with the role template.

The techniques described above provide the ability to have fine grainedcontrol over the set of rights granted to a tenant and, by extension, toall of its users. The techniques also provide flexibility in providingrole instances for a new tenant. Role instances for all new tenants canbe based on a set of role templates defined by the system administratorof the service provider. The role instances for a new tenant may bebased on role templates specifically selected during the tenant creationprocess. The techniques provide the ability to separate the concerns oforg-rights management and batch role provisioning and management.

Consider a service provider that has a person responsible for tenantsecurity (the tenant-security admin) and another person responsible formanaging batch role updates (the role admin). The tenant-security adminmay impose security constraints on a tenant by managing its org rights.The role administrator can enable or disable a feature for all eligibletenants by adding or removing a feature-specific right or rights to anexisting or new template or templates. The person conducting the roleadministration does not need to be concerned that any template updateswill conflict with any of the tenant security changes.

For example, consider a case where a service provider wants to unlocksome networking feature for a group of tenants who have paid for thenetwork feature. The tenant-security admin would grant the relatedrights to the group of tenants. The role administrator could update the“Organization Administrator” template to include the rights. This updatewould push the networking rights to linked “Organization Administrator”role instances in those organizations that have been granted thenetworking rights. Hence, users with the “Organization Administrator”role within these organizations would be authorized for the newnetworking features.

The order in which the administrators make their changes does notmatter. If the order in which the tenant-security admin and therole-admin did their work was reversed, i.e., the networking rights wereadded to the role template before the rights were granted to the targetorganizations, the net effect would still be the same because the systemwould synchronize the role instances in the target organizations suchthat they would include the networking rights.

If the tenant-security administrator decided to remove the networkingrights from one of the tenant organizations, the system wouldautomatically remove the rights from its instance of “OrganizationAdministrator” role.

From an organization administrator's perspective, role instances areowned and can be entirely managed by the organization administrator.Tenants do not share role instances. An organization administrator canadopt a hands-off approach where he or she creates no new roles and letsthe predefined role instances in the organization receive updates fromsystem-admin initiated template changes. Alternatively, the admin canexercise full control over the organization roles by creating new,custom roles and “unlinking” and customizing some or all of thepredefined role instances. These custom role instances would not havetheir rights synchronized, since they are unlinked from any roletemplate.

FIG. 4 is a flow diagram depicting a method 400 of synchronizing rightsin a role instance according to an embodiment. Method 400 begins at step402, where a system administrator of service provider 212 adds orremoves a right from rights 205 assigned to tenant 210. At step 404,cloud computing system 150 (e.g., tenant manager 153) synchronizes roleinstance 206 so that the right is added or removed from rights 208.

FIG. 5 is a flow diagram depicting a method 500 of synchronizing rightsin a role instance according to another embodiment. Method 500 begins atstep 502, where a system administrator of service provider 212 adds orremoves a right from default rights 204. At step 504, cloud computingsystem 150 (e.g., tenant manager 153) synchronizes role instance 206 sothat the right is added or removed from rights 208.

The various embodiments described herein may employ variouscomputer-implemented operations involving data stored in computersystems. For example, these operations may require physical manipulationof physical quantities—usually, though not necessarily, these quantitiesmay take the form of electrical or magnetic signals, where they orrepresentations of them are capable of being stored, transferred,combined, compared, or otherwise manipulated. Further, suchmanipulations are often referred to in terms, such as producing,identifying, determining, or comparing. Any operations described hereinthat form part of one or more embodiments of the invention may be usefulmachine operations. In addition, one or more embodiments of theinvention also relate to a device or an apparatus for performing theseoperations. The apparatus may be specially constructed for specificrequired purposes, or it may be a general purpose computer selectivelyactivated or configured by a computer program stored in the computer. Inparticular, various general purpose machines may be used with computerprograms written in accordance with the teachings herein, or it may bemore convenient to construct a more specialized apparatus to perform therequired operations.

The various embodiments described herein may be practiced with othercomputer system configurations including hand-held devices,microprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and the like.

One or more embodiments of the present invention may be implemented asone or more computer programs or as one or more computer program modulesembodied in one or more computer readable media. The term computerreadable medium refers to any data storage device that can store datawhich can thereafter be input to a computer system—computer readablemedia may be based on any existing or subsequently developed technologyfor embodying computer programs in a manner that enables them to be readby a computer. Examples of a computer readable medium include a harddrive, network attached storage (NAS), read-only memory, random-accessmemory (e.g., a flash memory device), a CD (Compact Discs)—CD-ROM, aCD-R, or a CD-RW, a DVD (Digital Versatile Disc), a magnetic tape, andother optical and non-optical data storage devices. The computerreadable medium can also be distributed over a network coupled computersystem so that the computer readable code is stored and executed in adistributed fashion.

Although one or more embodiments of the present invention have beendescribed in some detail for clarity of understanding, it will beapparent that certain changes and modifications may be made within thescope of the claims. Accordingly, the described embodiments are to beconsidered as illustrative and not restrictive, and the scope of theclaims is not to be limited to details given herein, but may be modifiedwithin the scope and equivalents of the claims. In the claims, elementsand/or steps do not imply any particular order of operation, unlessexplicitly stated in the claims.

Virtualization systems in accordance with the various embodiments may beimplemented as hosted embodiments, non-hosted embodiments or asembodiments that tend to blur distinctions between the two, are allenvisioned. Furthermore, various virtualization operations may be whollyor partially implemented in hardware. For example, a hardwareimplementation may employ a look-up table for modification of storageaccess requests to secure non-disk data.

Certain embodiments as described above involve a hardware abstractionlayer on top of a host computer. The hardware abstraction layer allowsmultiple contexts to share the hardware resource. In one embodiment,these contexts are isolated from each other, each having at least a userapplication running therein. The hardware abstraction layer thusprovides benefits of resource isolation and allocation among thecontexts. In the foregoing embodiments, virtual machines are used as anexample for the contexts and hypervisors as an example for the hardwareabstraction layer. As described above, each virtual machine includes aguest operating system in which at least one application runs. It shouldbe noted that these embodiments may also apply to other examples ofcontexts, such as containers not including a guest operating system,referred to herein as “OS-less containers” (see, e.g., www.docker.com).OS-less containers implement operating system-level virtualization,wherein an abstraction layer is provided on top of the kernel of anoperating system on a host computer. The abstraction layer supportsmultiple OS-less containers each including an application and itsdependencies. Each OS-less container runs as an isolated process inuserspace on the host operating system and shares the kernel with othercontainers. The OS-less container relies on the kernel's functionalityto make use of resource isolation (CPU, memory, block I/O, network,etc.) and separate namespaces and to completely isolate theapplication's view of the operating environments. By using OS-lesscontainers, resources can be isolated, services restricted, andprocesses provisioned to have a private view of the operating systemwith their own process ID space, file system structure, and networkinterfaces. Multiple containers can share the same kernel, but eachcontainer can be constrained to only use a defined amount of resourcessuch as CPU, memory and I/O. The term “virtualized computing instance”as used herein is meant to encompass both VMs and OS-less containers.

Many variations, modifications, additions, and improvements arepossible, regardless the degree of virtualization. The virtualizationsoftware can therefore include components of a host, console, or guestoperating system that performs virtualization functions. Pluralinstances may be provided for components, operations or structuresdescribed herein as a single instance. Boundaries between variouscomponents, operations and data stores are somewhat arbitrary, andparticular operations are illustrated in the context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within the scope of the invention(s). Ingeneral, structures and functionality presented as separate componentsin exemplary configurations may be implemented as a combined structureor component. Similarly, structures and functionality presented as asingle component may be implemented as separate components. These andother variations, modifications, additions, and improvements may fallwithin the scope of the appended claim(s).

We claim:
 1. A method of managing rights in a cloud computing system,comprising: creating a role template having a role template set ofrights to resources in the cloud computing system; assigning a tenantset of rights to the resources to each of a plurality of tenants of thecloud computing system, respectively; and creating a role instance foreach respective tenant of the plurality of tenants based on the roletemplate and assigning the role instance to each respective tenant ofthe plurality of tenants, wherein: the role instance is linked to therole template in the cloud computing system; the role instance includesa role instance set of rights that is an intersection of the roletemplate set of rights and the tenant set of rights for the respectivetenant; and the role instance set of rights does not include one or morerights that are in the role template set of rights and not in the tenantset of rights for the respective tenant.
 2. The method of claim 1,further comprising: adding custom rights to the role instance set ofrights for a first tenant of the plurality of tenants, the custom rightsselected from the tenant set of rights for the first tenant and notincluded in the role template set of rights.
 3. The method of claim 1,further comprising: adding a new right to the tenant set of rights of afirst tenant of the plurality of tenants, where the new right is part ofthe role template set of rights; and synchronizing the role instance forthe first tenant such that the new right is added to the role instanceset of rights for the first tenant.
 4. The method of claim 1, furthercomprising: removing a selected right from the tenant set of rights of afirst tenant of the plurality of tenants, where the selected right ispart of the role instance set of rights for the first tenant; andsynchronizing the role instance of the first tenant such that theselected right is removed from the role instance set of rights for thefirst tenant.
 5. The method of claim 1, further comprising: adding a newright to the role template set of rights, where the new right is part ofthe tenant set of rights for a first tenant of the plurality of tenants;and synchronizing the role instance of the first tenant such that thenew right is added to the role instance set of rights for the firsttenant.
 6. The method of claim 1, further comprising: removing aselected right from the role template set of rights; and synchronizingthe role instance of a first tenant of the plurality of tenants suchthat the selected right is removed from the role instance set of rightsof the first tenant.
 7. The method of claim 1, wherein each right in therole template set of rights for each tenant of the plurality of tenants,the tenant set of rights for each tenant of the plurality of tenants,and the role instance set of rights for each tenant of the plurality oftenants is permission to access a resource in the cloud computingsystem.
 8. A non-transitory computer readable medium having storedthereon instructions, which when executed on a computer, cause thecomputer to perform a method of managing rights in a cloud computingsystem, comprising: creating a role template having a role template setof rights to resources in the cloud computing system; assigning a tenantset of rights to the resources to each of a plurality of tenants of thecloud computing system, respectively; and creating a role instance foreach respective tenant of the plurality of tenants based on the roletemplate and assigning the role instance to each respective tenant ofthe plurality of tenants, wherein: the role instance is linked to therole template in the cloud computing system; the role instance includesa role instance set of rights that is an intersection of the roletemplate set of rights and the tenant set of rights for the respectivetenant; and the role instance set of rights does not include one or morerights that are in the role template set of rights and not in the tenantset of rights for the respective tenant.
 9. The non-transitory computerreadable medium of claim 8, wherein the method further comprises: addingcustom rights to the role instance set of rights for a first tenant ofthe plurality of tenants, the custom rights selected from the tenant setof rights for the first tenant and not included in the role template setof rights.
 10. The non-transitory computer readable medium of claim 8,wherein the method further comprises: adding a new right to the tenantset of rights for a first tenant of the plurality of tenants, where thenew right is part of the role template set of rights; and synchronizingthe role instance for the first tenant such that the new right is addedto the role instance set of rights for the first tenant.
 11. Thenon-transitory computer readable medium of claim 8, wherein the methodfurther comprises: removing a selected right from the tenant set ofrights for a first tenant of the plurality of tenants, where theselected right is part of the role instance set of rights for the firsttenant; and synchronizing the role instance for the first tenant suchthat the selected right is removed from the role instance set of rightsfor the first tenant.
 12. The non-transitory computer readable medium ofclaim 8, wherein the method further comprises: adding a new right to therole template set of rights, where the new right is part of the tenantset of rights for a tenant of the plurality of tenants; andsynchronizing the role instance such that the new right is added to therole instance set of rights for the first tenant.
 13. The non-transitorycomputer readable medium of claim 8, wherein the method furthercomprises: removing a selected right from the role template set ofrights; and synchronizing the role instance for a first tenant of theplurality of tenants such that the selected right is removed from therole instance set of rights for the first tenant.
 14. The non-transitorycomputer readable medium of claim 8, wherein each right in the roletemplate set of rights for each tenant of the plurality of tenants, thetenant set of rights for each tenant of the plurality of tenants, andthe role instance set of rights for each tenant of the plurality oftenants is permission to access a resource in the cloud computingsystem.
 15. A computer system in a cloud computing system, comprising: ahardware platform having a central processing unit (CPU) and a memory;and a software platform having code stored in the memory and configuredfor execution by the CPU to: create a role template having a roletemplate set of rights to resources in the cloud computing system;assign a tenant set of rights to the resources to each of a plurality oftenants of the cloud computing system, respectively; and create a roleinstance for each respective tenant of the plurality of tenants based onthe role template and assigning the role instance to each respectivetenant of the plurality of tenants, wherein: the role instance is linkedto the role template in the cloud computing system; the role instanceincludes a role instance set of rights that is an intersection of therole template set of rights and the tenant set of rights for therespective tenant; and the role instance set of rights does not includeone or more rights that are in the role template set of rights and notin the tenant set of rights for the respective tenant.
 16. The computingsystem of claim 15, wherein the code is configured for execution by theCPU to: add custom rights to the role instance set of rights for a firsttenant of the plurality tenants, the custom rights selected from thetenant set of rights for the first tenant and not included in the roletemplate set of rights.
 17. The computing system of claim 15, whereinthe code is configured for execution by the CPU to: add a new right tothe tenant set of rights for a first tenant of the plurality of tenants,where the new right is part of the role template set of rights; andsynchronize the role instance for the first tenant such that the newright is added to the role instance set of rights for the first tenant.18. The computing system of claim 15, wherein the code is configured forexecution by the CPU to: remove a selected right from the tenant set ofrights for a first tenant of the plurality of tenants, where theselected right is part of the role instance set of rights for the firsttenant; and synchronize the role instance for the first tenant such thatthe selected right is removed from the role instance set of rights forthe first tenant.
 19. The computing system of claim 15, wherein the codeis configured for execution by the CPU to: add a new right to the roletemplate set of rights, where the new right is part of the tenant set ofrights for a first tenant of the plurality of tenants; and synchronizethe role instance for the first tenant such that the new right is addedto the role instance set of rights for the first tenant.
 20. Thecomputing system of claim 15, wherein the code is configured forexecution by the CPU to: remove a selected right from the role templateset of rights; and synchronize the role instance for a first tenant ofthe plurality of tenants such that the selected right is removed fromthe role instance set of rights for the first tenant.